YOLOv7

Findings · 12

1. 1 Multiple uses of subprocess.check_output with shell=True could allow command injection High
2. 2 Models are stored and loaded as pickle files throughout the YOLO codebase High
3. 3 Parsing of YAML config file can lead to arbitrary code execution High
4. 4 Untrusted pre-trained models can lead to arbitrary code execution High
5. 5 Multiple uses of os.system could allow command injection High
6. 6 Use of unencrypted HTTP protocol Low
7. 7 Insecure origin check Low
8. 8 The check_dataset function downloads and unzips files from arbitrary URLs Low
9. 9 Insucient input validation in triton inference server could result in uncaught exception at runtime Medium
10. 10 Improper use of TorchScript tracing leads to model dierentials Medium
11. 11 Project lacks adequate testing framework Informational
12. 12 Flaw in detect.py will cause runtime exceptions to occur when using a traced model Low

Findings extracted from the published report PDF. See the full report below for details and remediation.